4.3

CVE-2026-23866

Medienbericht
Incomplete validation of AI rich response messages for Instagram Reels in WhatsApp for iOS v2.25.8.0 to v2.26.15.72 and WhatsApp for Android v2.25.8.0 to v2.26.7.10 could have allowed a user to trigger processing of media content from an arbitrary URL on another user’s device, including triggering OS-controlled custom URL scheme handlers. We have not seen evidence of exploitation in the wild.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
WhatsApp ≫ WhatsApp SwPlatformandroid Version >= 2.25.8.0 <= 2.26.7.10
WhatsApp ≫ WhatsApp SwPlatformiphone_os Version >= 2.25.8.0 <= 2.26.15.72
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.46% 0.367
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
cve-assign@fb.com 4.3 2.8 1.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CWE-940 Improper Verification of Source of a Communication Channel

The product establishes a communication channel to handle an incoming request that has been initiated by an actor, but it does not properly verify that the request is coming from the expected origin.

Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
VulnDex Intel
Media Report
11.05.2026 16:03
https://www.whatsapp.com/security/advisories/2026
Vendor Advisory
https://www.facebook.com/security/advisories/cve-2026-23866
Third Party Advisory